Also known as: Win32/Dluca.F.Trojan, W32/Dlucadl.K (F-Secure), TrojanDownloader.Win32.Dluca.p (Kaspersky)
Description Modified: March 19, 2004
When executed, Dluca.F copies itself to: %System%\ sncntr.exe. It then modifies the following registry entry to ensure that this copy is run at each Windows start:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sncntr = "%System%\sncntr.exe /nocomm"
Note: '%System%' is a variable location. The trojan determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.
Dluca.F also adds an uninstall entry to the registry, using these values:
HKLM\software\microsoft\windows\currentversion\uninstall\sncntr\UninstallString = "%System%\sncntr.exe /uninstall"
HKLM\software\microsoft\windows\currentversion\uninstall\sncntr\DisplayName = "sncntr"
The uninstall can be activated through the "Add/Remove Programs" dialog, accessed via the Control Panel. The entry is titled "sncntr", and it removes sncntr.exe and all associated registry values added by the trojan.
One of the best French door fridges we've tested
A good-looking fridge with useful features like an auto-filling water pitcher and a temperature-adjustable "FlexZone" drawer. It was a near-flawless performer in our cooling tests.